CVE-2026-16870 exposes multiple stack‑based buffer overflows, out‑of‑bounds writes, and improper validation in the Snowflake libsnowflakeclient. An attacker can craft a file with malformed encryption or initialization vector metadata to trigger a stack overflow or memory corruption during a download from an internal stage, enabling remote code execution. Additionally, unsanitized connection parameters allow the redirection of authentication traffic, potentially leaking credentials and tokens. The vulnerabilities are classed as buffer overflows (CWE‑121) and out‑of‑bounds write (CWE‑787) with potential for credential theft (CWE‑918).

Affected products are the Snowflake ODBC Driver, the Snowflake PHP PDO Driver, and the Snowflake libsnowflakeclient itself. Versions before 2.9.2 of libsnowflakeclient, before 3.19.0 of the ODBC driver, and before 4.1.0 of the PHP PDO driver contain the flaw. The flaw manifests only when a privileged principal shares a stage with a lower‑privileged principal and the lower‑privileged principal uploads or influences the content of that stage.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1 % shows that, as of this assessment, the likelihood of exploitation remains low. The vulnerability is not listed in the CISA KEV catalog. The attack surface is limited to environments where stages are shared across privilege levels or where connection configuration can be influenced by lower‑privileged entities. The exploit requires the attacker to upload or influence malicious metadata on a shared internal stage or to supply manipulated connection parameters, which is typically only possible if the attacker can write to the stage or control the client configuration. In environments lacking such privilege or upload capabilities, the risk is mitigated.